1. Field of the Invention
The present invention relates to Mobile IP network technology. More particularly, the present invention relates to Mobile IP registration and authentication of Mobility Entities using dynamically generated keys.
2. Description of the Related Art
Mobile IP is a protocol that allows laptop computers and other mobile computer units (“mobile nodes”) to roam between various sub-networks while maintaining Internet and/or WAN connectivity. Without Mobile IP or similar protocols a mobile node would be unable to stay connected while roaming from one location serviced by one sub-network to another location being serviced by a different sub-network. This is because each IP address has a field that specifies the particular sub-network on which the node resides. If a user desires to take a computer that is normally attached to one network and roam so that it passes through different sub-networks, the roaming computer cannot use its home base IP address. As a result, a businessperson traveling across the country cannot travel with his or her computer across geographically disparate network segments or wireless nodes while maintaining Internet connectivity. This is not acceptable in the age of portable computational devices.
To address this problem, the Mobile IP protocol has been developed and implemented. An implementation of Mobile IP is described in RFC 3220, “IP Mobility Support for IPv4” of the Network Working Group, C. Perkins, Ed., January 2002. Mobile IP is also described in the text “Mobile IP, The Internet Unplugged” by J. Solomon, Prentice Hall, 1998. Both of these references are incorporated herein by reference in their entireties and for all purposes.
The Mobile IP process and environment are illustrated in FIG. 1. A Mobile IP environment 100 includes the Internet (or a WAN) 105 over which a mobile node 110 can communicate via mediation by a home agent 115 or a foreign agent 120. Typically, the home agent 115 and foreign agent 120 are routers or other network connection devices performing appropriate Mobile IP functions as implemented by software, hardware, and/or firmware. Note the overall network topology is arbitrary, and elements such as the home agent 115 need not directly connect to the Internet 105. For example, the home agent 115 may be connected through another router R1 125. Router R1 125 may, in turn, connect one or more other routers R3 130 with the Internet 105.
When mobile node 110 is plugged into its home network segment 135 it connects with the Internet 105 through its designated home agent 115. When the mobile node 110 roams, it can be connected to a remote network segment 140 and communicate through the available foreign agent 120. Other nodes, such as a PC 145, on remote network segment 140 also communicate with the Internet 105 through foreign agent 120. Presumably, there are many foreign agents available at geographically disparate locations to allow wide spread Internet connection via the Mobile IP protocol.
Mobile node 110 may identify foreign agent 120 through various agent solicitations and agent advertisements that form part of the Mobile IP protocol. When mobile node 110 engages with remote network segment 140, it composes a registration request for the home agent 115 to bind the mobile node's 110 current location with its home location. Foreign agent 120 then relays the registration request 150 to home agent 115. During the registration process, the home agent 115 and the mobile node 110 may then negotiate the conditions of the mobile node's 110 attachment to foreign agent 120. For example, the mobile node 110 may request a registration lifetime of 5 hours, but the home agent 115 may grant only a 3 hour period. When the negotiation is successfully completed, home agent 115 updates an internal “mobility binding table” which links the mobile node's 110 current location via its care-of address (e.g., a co-located care-of address or the foreign agent's IP address) to the identity (e.g., home address) of the mobile node 110. Further, if the mobile node 110 registered via foreign agent 120, the foreign agent 120 updates an internal “visitor table” which specifies the mobile node address, home agent address, etc. The home agent's 115 association between a mobile node's home base IP address, its current care-of address, and the remaining lifetime of that association is referred to as a binding.
If mobile node 110 wanted to send a message to a correspondent node 155 from its new location, the mobile node 110 would forward a packetized output message 160 through the foreign agent 120 over the Internet 105 to the correspondent node 155 according to standard Internet protocols. However, if the correspondent node 155 wanted to send a message 165 to the mobile node 110—whether in reply to a message from the mobile node 110 or for any other reason—the correspondent node 155 addresses that message to the IP address of the mobile node 110 as if the mobile node 110 were on the home network segment 135. The packets of the message from the correspondent node 155 are forwarded over the Internet 105 to the router R2 125 and ultimately to the home agent 115.
From the home agent's 115 mobility binding table, the home agent 115 recognizes that the mobile node 110 is no longer attached to the home network segment 135. The home agent 115 then encapsulates the packets from correspondent node 155 (which are addressed to the mobile node 110 on the home network segment 135) according to the Mobile IP protocol, and forwards these encapsulated packets 170 to the appropriate care-of address for mobile node 110. If the care-of address is the IP address of the foreign agent 120 the foreign agent 120 strips the encapsulation and forwards the message to the mobile node 110 on the remote network segment 140. The packet forwarding mechanism implemented by the home agent 115 to the foreign agent 120 is often referred to as “tunneling.”
As set forth above, under current standards as set forth in RFC 2002 and RFC 3220, a Mobile Node registers with a Home Agent each time it roams to a new location. The Home Agent validates (i.e., authenticates) its communication with the Mobile Node based upon a security association. Specifically, the registration request that is sent by a Mobile Node typically identifies a Security Parameter Index (SPI), which is an identifier that specifies a security association, or “row” in a security-association table, that a receiver should use to interpret a received packet. The security-association defines the key and the algorithm to be applied during the authentication process. The security associations for multiple mobile nodes are typically stored on an external server and sent to the Home Agent when a particular Mobile Node registers with the Home Agent.
The external server typically is a centralized server, which is capable of storing and updating accounting information for multiple mobile nodes as well as multiple network devices. In addition, the centralized server may provide further services. By way of example, the centralized server may provide authentication services and/or authorization services. While authentication determines “who” an entity is, authorization determines what services a user is allowed to perform, or access. A class of servers known as “AAA” or triple-A servers may be employed. The AAA represents authentication, authorization, and accounting. Various protocols such as the Remote Authentication Dial In User Service (RADIUS) and TACACS+ may be implemented to provide such a server. Note that the Home Agent or Foreign Agent providing accounting information to the server must provide communications in formats required by the AAA server protocol. RFC 2138 describes the RADIUS Protocol and is hereby incorporated by reference. Similarly, RFC 1492 describes TACACS and the Internet-Draft “The TACACS+ Protocol Version 1.78,” available at http://www.ietf.org/internet-drafts/draft-grant-tacacs-02.txt, describes TACACS+. Both of these documents are incorporated herein by reference for all purposes.
As set forth above, a Home Agent can authenticate a registration request sent by a Mobile Node or a registration reply sent to a Mobile Node. In order to accomplish this authentication, a key that is shared by the Mobile Node and the Home Agent is typically pre-configured. Thus, the shared key is statically configured and therefore both the Mobile Node and the Home Agent are configured with this shared key. While static configuration is simple and efficient, the pre-configured key shared by the Mobile Node and the Home Agent is exposed over time, enabling the key to be reverse engineered. Thus, the standard mechanism for authenticating registration request and reply packets is insecure.
The Kerberos Network Authentication Service is described in RFC 1510, entitled “The Kerberos Network Authentication Service (V5),” by Kohl et al, September 1993. Kerberos. Kerberos enables keys to be dynamically generated for communication between two different nodes, providing a secure infrastructure for communication between the two nodes. While Kerberos has been widely deployed in enterprise systems, Kerberos has not been employed in a Mobile IP environment.
In view of the above, it would be desirable if a more secure, dynamic mechanism for authenticating communication in a Mobile IP environment were implemented.